ISC2 Certified Cloud Security Professional493 questions across 50 pages are complete and free, with no account or card.
493 questions in this bank
Free access · progress saved on this device
Different security testing methodologies offer different strategies and approaches to testing systems, requiring security personnel to determine the best type to use for their specific circumstances. What does dynamic application security testing (DAST) NOT entail that SAST does?
Answer: B
You need to gain approval to begin moving your company's data and systems into a cloud environment. However, your CEO has mandated the ability to easily remove your IT assets from the cloud provider as a precondition. Which of the following cloud concepts would this pertain to?
Answer: D
Reversibility is the cloud concept involving the ability for a cloud customer to remove all of its data and IT assets from a cloud provider. Also, processes and agreements would be in place with the cloud provider that ensure all removals have been completed fully within the agreed upon timeframe. Portability refers to the ability to easily move between different cloud providers and not be locked into a specific one. Removability and extraction are both provided as terms similar to reversibility, but neither is the official term or concept.
What does static application security testing (SAST) offer as a tool to the testers that makes it unique compared to other common security testing methodologies?
Answer: B
Static application security testing (SAST) is conducted against offline systems with previous knowledge of them, including their source code. Live testing is not part of static testing but rather is associated with dynamic testing. Production system scanning is not appropriate because static testing is done against offline systems. Injection attempts are done with many different types of testing and are not unique to one particular type. It is therefore not the best answer to the question.
A main objective for an organization when utilizing cloud services is to avoid vendor lock-in so as to ensure flexibility and maintain independence. Which core concept of cloud computing is most related to vendor lock-in?
Answer: C
We are talking about Vendor lock-in, which has to do with the ability to move service providers if we need to. So the answer is Portability
Source: Adapted from community discussion — Bill_nye_russian_guy
Which of the following areas of responsibility always falls completely under the purview of the cloud provider, regardless of which cloud service category is used?
Answer: C
Regardless of the cloud service category used, the physical environment is always the sole responsibility of the cloud provider. In many instances, the cloud provider will supply audit reports or some general information about their physical security practices, especially to those customers or potential customers that may have regulatory requirements, but otherwise the cloud customer will have very little insight into the physical environment. With IaaS, the infrastructure is a shared responsibility between the cloud provider and cloud customer. With all cloud service categories, the data and governance are always the sole responsibility of the cloud customer.
What type of masking would you employ to produce a separate data set for testing purposes based on production data without any sensitive information?
Answer: D
Which aspect of data poses the biggest challenge to using automated tools for data discovery and programmatic data classification?
Answer: C
The biggest challenge for properly using any programmatic tools in data discovery is the actual quality of the data, including the data being uniform and well structured, labels being properly applied, and other similar facets. Without data being organized in such a manner, it is extremely difficult for programmatic tools to automatically synthesize and make determinations from it. The overall quantity of data, as well as the number of sources, does not pose an enormous challenge for data discovery programs, other than requiring a longer time to process the data. The language of the data itself should not matter to a program that is designed to process it, as long as the data is well formed and consistent.
When an organization is considering a cloud environment for hosting BCDR solutions, which of the following would be the greatest concern?
Answer: C
Which of the following roles is responsible for preparing systems for the cloud, administering and monitoring services, and managing inventory and assets?
Answer: C
The cloud service operations manager is responsible for preparing systems for the cloud, administering and monitoring services, providing audit data as requested or required, and managing inventory and assets.
Source: Adapted from community discussion — TheFivePips
Just like the risk management process, the BCDR planning process has a defined sequence of steps and processes to follow to ensure the production of a comprehensive and successful plan. Which of the following is the correct sequence of steps for a BCDR plan?
Answer: A
Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page
CCSP practice, question 311. 493 questions available.
Version 1.0.0. How we source questions